What's changed: Added per-section figures (cert-figure-retrofit). New AI-103 Chapter 1 (plan & manage: project/resources, model selection = capability/modality/context/cost/regional availability/routing, deployment = serverless vs managed compute, TPM quota/cost, security = managed identity/keyless/RBAC/private endpoint, monitoring/evaluation/Content Safety/Responsible AI)
1.2Security, Identity, Networking, and Monitoring
Understand production security for AI solutions from a developer’s view—managed identity / keyless auth, role-based access control (RBAC), private networking, monitoring and logging, and Responsible AI governance.
A production AI app must not only "work" but work securely and under governance. AI-103’s plan/manage domain asks how a developer designs authentication, access control, networking, monitoring, and Responsible AI governance. The central ideas are least privilege and holding no secrets (keyless).
1.2.1Authentication — API key vs managed identity (keyless)
You can access models/services with a convenient API key, but production favors keyless auth via managed identity. Managed identity automatically grants an Azure resource (app or function) a Microsoft Entra ID identity, so you authenticate without placing secret keys in code or config. This removes the operational burden and risk of key leakage and rotation. Grant permissions to the identity via RBAC roles (e.g., Azure AI reader/user roles) at least privilege.
1.2.2Network isolation
For sensitive data, isolate services from the public internet. With private endpoints, traffic to an AI service is restricted to private IPs inside a virtual network, and you can disable public network access. This reduces exposure of data and model calls. Developers design topologies that connect the app, data stores, and AI services over the same VNet / private connectivity.
1.2.3Monitoring, logging, safety, and governance
In operation, continuously monitor usage, cost, quality, and safety. Collect metrics and logs (call counts, token usage, errors, latency) and set threshold alerts. Guard output safety with Azure AI Content Safety (detect/block harmful content) and measure generation quality via evaluation. These also operationally uphold Responsible AI principles (reliability & safety, accountability, privacy). Audit logs make "who did what, when" traceable.
| Requirement | Design |
|---|---|
| Avoid storing secret keys | Keyless auth via managed identity |
| Least-privilege access | Assign only needed RBAC roles to the identity |
| Avoid public exposure | Private endpoint + disable public access |
| Prevent harmful output | Azure AI Content Safety |
| Measure quality | Evaluation and monitoring |
Common: (1) "authenticate without secret keys in code" = managed identity (keyless). (2) "least-privilege access" = RBAC + least privilege. (3) "isolate the AI service from the public internet" = private endpoint + disable public access. (4) "block harmful output" = Azure AI Content Safety. (5) "measure generation quality" = evaluation.
Watch out: (1) authentication (who you are) and authorization/RBAC (what you can do) differ—authenticate with managed identity, scope with RBAC. (2) API keys are easy but carry leakage/rotation burden—prefer keyless in production. (3) Private endpoints are network isolation, a separate layer from auth/RBAC (use together for defense in depth). (4) Monitoring, evaluation, and Content Safety are operational requirements, not optional.
1.2.4Section summary
- Auth: production uses keyless auth via managed identity (no secret keys); API keys carry leakage/rotation burden
- Authz: assign RBAC roles at least privilege to the identity (auth and authz are separate layers)
- Network: isolate via private endpoint + disabling public access
- Ops: uphold safety/quality via metrics/log monitoring, Content Safety, and evaluation (operational Responsible AI)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which production-recommended method authenticates to Azure AI services without secret keys in code/config?
Q2. Which mechanism restricts AI-service traffic to private IPs in a VNet and avoids public-internet exposure?
Q3. Which correctly describes authentication (who you are) vs authorization/RBAC (what you can do)?
Q4. What blocks harmful content (violence, hate) in a generative AI app’s output?
Q5. What is needed to continuously track usage, cost, quality, and safety of an AI solution in production?
Q6. Which is the most appropriate policy for assigning RBAC roles?